64e8c62f18
Same shape as the others. Three of the eight references were prose rather than code: two assertion messages naming the option to an operator, and a `defaultText` in the authelia module, whose `oidc.hiveIdentities` derives from whether the queue runs here. Also corrects a comment in swarm.nix that this commit's own hunk sits directly beneath. It said `enableRequiredServices` turns on matrix and authelia "but NOT nats (nats has no mode that enables it)", which stopped being true when the queue was added to that switch — before this change, not by it. The reasoning it introduces is still right and still worth keeping; only the premise had expired.
170 lines
6.3 KiB
Nix
170 lines
6.3 KiB
Nix
# "What does THIS host deploy?"
|
|
#
|
|
# Separated from `services.hyperhive.swarm.*` because those are two
|
|
# different kinds of fact and only one of them varies per machine:
|
|
#
|
|
# swarm.* — swarm-wide truth. The swarm's name, domain, hives, peers,
|
|
# CA, and where each service lives. **Identical on every
|
|
# host**, byte for byte; a hive needs all of it to be a
|
|
# *client* of the swarm.
|
|
# deploy.* — this machine's deployment decisions. Necessarily different
|
|
# on every host, because that is what a deployment is.
|
|
#
|
|
# The `enable` toggles used to live under `swarm.*`, which made the
|
|
# namespace that is supposed to be identical everywhere carry the one
|
|
# thing that must differ.
|
|
#
|
|
# Flat and named for the thing deployed — `deploy.forgejo`, not
|
|
# `deploy.swarmServices.forgejo`. Grouping by "swarm service" would
|
|
# re-encode the service-side taxonomy into a layer that does not care
|
|
# about it: from here, a host deploys forgejo, or a hive, or the lot, and
|
|
# what *kind* of thing each one is belongs to the service module.
|
|
#
|
|
# ⚠️ The renames below are deliberately in this one file rather than
|
|
# spread across the service modules, so the whole move has a single home
|
|
# and a single file to delete when the deprecation window closes — the
|
|
# shape ./swarm-peers-removed.nix already uses.
|
|
{ lib, config, ... }:
|
|
let
|
|
deployCfg = config.services.hyperhive.deploy;
|
|
in
|
|
{
|
|
imports = [
|
|
# Same type, same meaning, new path — so a rename carries it exactly
|
|
# and existing configs keep evaluating with one warning naming both
|
|
# paths. Precedent: ./hive-forge/default.nix, ./hive-matrix.nix.
|
|
(lib.mkRenamedOptionModule
|
|
[ "services" "hyperhive" "swarm" "grafana" "enable" ]
|
|
[ "services" "hyperhive" "deploy" "grafana" ]
|
|
)
|
|
(lib.mkRenamedOptionModule
|
|
[ "services" "hyperhive" "swarm" "victoriametrics" "enable" ]
|
|
[ "services" "hyperhive" "deploy" "victoriametrics" ]
|
|
)
|
|
(lib.mkRenamedOptionModule
|
|
[ "services" "hyperhive" "swarm" "victorialogs" "enable" ]
|
|
[ "services" "hyperhive" "deploy" "victorialogs" ]
|
|
)
|
|
(lib.mkRenamedOptionModule
|
|
[ "services" "hyperhive" "swarm" "controller" "enable" ]
|
|
[ "services" "hyperhive" "deploy" "controller" ]
|
|
)
|
|
(lib.mkRenamedOptionModule
|
|
[ "services" "hyperhive" "swarm" "ui" "enable" ]
|
|
[ "services" "hyperhive" "deploy" "swarm-ui" ]
|
|
)
|
|
(lib.mkRenamedOptionModule
|
|
[ "services" "hyperhive" "swarm" "authelia" "enable" ]
|
|
[ "services" "hyperhive" "deploy" "authelia" ]
|
|
)
|
|
(lib.mkRenamedOptionModule
|
|
[ "services" "hyperhive" "swarm" "nats" "enable" ]
|
|
[ "services" "hyperhive" "deploy" "nats" ]
|
|
)
|
|
];
|
|
|
|
options.services.hyperhive.deploy = {
|
|
grafana = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = false;
|
|
description = ''
|
|
Run the swarm's metrics UI on this host.
|
|
|
|
Off by default and not derived from
|
|
{option}`services.hyperhive.enable`: a swarm has one Grafana, so
|
|
running it is a decision about this host rather than about
|
|
whether hyperhive is installed.
|
|
'';
|
|
};
|
|
|
|
victoriametrics = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = false;
|
|
description = ''
|
|
Run the swarm's metrics store on this host.
|
|
|
|
Derives from
|
|
{option}`services.hyperhive.swarm.enableRequiredServices` together
|
|
with {option}`services.hyperhive.deploy.grafana`: a store with no
|
|
UI is unreadable and a UI with no store is empty, so there is no
|
|
sensible deployment that takes one and not the other from that
|
|
switch. Set either directly to run exactly one.
|
|
'';
|
|
};
|
|
|
|
victorialogs = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = false;
|
|
description = ''
|
|
Run the swarm's log store on this host.
|
|
|
|
Derives from
|
|
{option}`services.hyperhive.swarm.enableRequiredServices` for the
|
|
same reason as the metrics pair above: a hive that is not the
|
|
service host is a *client* of this store, not a second one.
|
|
'';
|
|
};
|
|
|
|
authelia = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = false;
|
|
example = true;
|
|
description = ''
|
|
Run the swarm's authelia in a `swarm-authelia` container on this
|
|
host. {option}`services.hyperhive.swarm.enableRequiredServices`
|
|
turns this on — a swarm has one SSO provider, and that says it
|
|
lives here.
|
|
|
|
With it off, this hive is a *client*:
|
|
{option}`services.hyperhive.swarm.authelia.url` still points at
|
|
whoever runs it, and no container is created. That asymmetry is
|
|
why the two live in different namespaces — every hive needs the
|
|
client half, only one runs the server half.
|
|
'';
|
|
};
|
|
|
|
nats = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = false;
|
|
description = ''
|
|
Run the swarm's message queue in a `swarm-nats` container on this
|
|
host. A swarm has one queue, so this belongs on the same host as
|
|
the rest of the shared services.
|
|
|
|
Off by default, and off means *absent*: no container is created
|
|
and nothing else in the evaluated config changes.
|
|
'';
|
|
};
|
|
|
|
controller = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = false;
|
|
description = ''
|
|
Run the swarm-controller daemon on this host.
|
|
|
|
Off by default and deliberately not derived from
|
|
{option}`services.hyperhive.enable`: a swarm has one controller,
|
|
so running it is a decision about this host rather than about
|
|
whether hyperhive is installed.
|
|
'';
|
|
};
|
|
|
|
swarm-ui = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = deployCfg.controller;
|
|
defaultText = lib.literalExpression "services.hyperhive.deploy.controller";
|
|
example = true;
|
|
description = ''
|
|
Serve the swarm UI from this host.
|
|
|
|
Derived from {option}`services.hyperhive.deploy.controller` rather
|
|
than from
|
|
{option}`services.hyperhive.swarm.enableRequiredServices`: the UI
|
|
is a view onto the controller's state and reaches it over that
|
|
daemon's unix socket, so the host that runs the controller is the
|
|
host that can serve the UI. A hive that merely *uses* a swarm has
|
|
nothing to serve here.
|
|
'';
|
|
};
|
|
};
|
|
}
|